{"api_version":"v1","generated_at":"2026-10-10T02:15:00+00:00","product":{"cve_count":16,"evidence_gap_note":"Official registry publication history is linked, but a publisher support or retirement boundary has not been established.","id":"security:cve-saleor-saleor-dff0d3b28d23","lifecycle_state":"evidence_gap","linked_lifecycle_url":"https://lifecycle.blacktree.nl/libraries/npm/saleor","name":"Saleor","next_cursor":null,"observations":[{"affected":"saleor: >= 2.10.0rc1, < 3.21.67, >= 3.22.0-a.0, < 3.22.63, >= 3.23.0-a.0, < 3.23.22","affected_versions_present":true,"cve_id":"CVE-2026-44472","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-44472","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-08-18T17:29:33.282Z","patch_url":"","primary_source":"","published":"2026-08-18T17:11:42.399Z"},{"affected":"saleor: >= 3.14.67, < 3.21.67, >= 3.22.0-a.0, < 3.22.63, >= 3.23.0-a.0, < 3.23.22","affected_versions_present":true,"cve_id":"CVE-2026-48744","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-48744","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2026-08-19T18:21:42.815Z","patch_url":"","primary_source":"","published":"2026-08-18T17:10:05.214Z"},{"affected":">= 2.10.0, < 3.20.118; >= 3.21.0-a.0, < 3.21.54; >= 3.22.0-a.0, < 3.22.47; >= 3.23.0-a.0, < 3.23.0a3","affected_versions_present":true,"cve_id":"CVE-2026-39851","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-39851","fixed":"An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.","last_modified":"2026-04-08T19:22:20.422Z","patch_url":"https://github.com/saleor/saleor/security/advisories/GHSA-m3rm-m4vq-27x7","primary_source":"","published":"2026-04-08T17:33:37.998Z"},{"affected":">= 2.10.0, < 3.20.118; >= 3.21.0-a.0, < 3.21.54; >= 3.22.0-a.0, < 3.22.47; >= 3.23.0-a.0, < 3.23.0a3","affected_versions_present":true,"cve_id":"CVE-2026-35407","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-35407","fixed":"An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.","last_modified":"2026-04-10T20:36:19.733Z","patch_url":"https://github.com/saleor/saleor/commit/7be352fa8c35875d6e66d36493ca7c14c101bd64","primary_source":"","published":"2026-04-08T17:24:39.716Z"},{"affected":">= 2.0.0, < 3.20.118; >= 3.21.0-a.0, < 3.21.54; >= 3.22.0-a.0, < 3.22.47; >= 3.23.0-a.0, < 3.23.0a3","affected_versions_present":true,"cve_id":"CVE-2026-35401","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-35401","fixed":"An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.","last_modified":"2026-04-08T19:21:37.796Z","patch_url":"https://github.com/saleor/saleor/security/advisories/GHSA-gqqv-xwx3-jj4h","primary_source":"","published":"2026-04-08T17:22:10.683Z"},{"affected":">= 2.0.0, < 3.20.118; >= 3.21.0-a.0, < 3.21.54; >= 3.22.0-a.0, < 3.22.47; >= 3.23.0-a.0, < 3.23.0a3","affected_versions_present":true,"cve_id":"CVE-2026-33756","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-33756","fixed":"An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.","last_modified":"2026-04-08T18:42:28.521Z","patch_url":"https://github.com/saleor/saleor/security/advisories/GHSA-24jw-f244-qfpp","primary_source":"","published":"2026-04-08T17:07:57.920Z"},{"affected":">= 3.22.0-a.0, < 3.22.29; >= 3.21.0-a.0, < 3.21.45; >= 3.2.0, < 3.20.110","affected_versions_present":true,"cve_id":"CVE-2026-24136","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-24136","fixed":"An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.","last_modified":"2026-01-26T17:10:16.445Z","patch_url":"https://github.com/saleor/saleor/commit/5dab1857fbb2801f74e2bfe86f307e4590d9d2fa","primary_source":"","published":"2026-01-23T23:38:31.414Z"},{"affected":">= 3.2.0, < 3.22.27; >= 3.1.0, < 3.21.43; >= 3.0.0, < 3.20.108","affected_versions_present":true,"cve_id":"CVE-2026-23499","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-23499","fixed":"An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.","last_modified":"2026-01-22T16:50:13.686Z","patch_url":"https://github.com/saleor/saleor/commit/77f7927a0db9a216440df92c51012136f13e1d99","primary_source":"","published":"2026-01-21T21:36:19.702Z"},{"affected":">= 3.2.0, < 3.22.27; >= 3.1.0, < 3.21.43; >= 3.0.0, < 3.20.108","affected_versions_present":true,"cve_id":"CVE-2026-22849","cve_url":"https://cve.blacktree.nl/cve/CVE-2026-22849","fixed":"An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.","last_modified":"2026-01-22T16:50:18.828Z","patch_url":"https://github.com/saleor/saleor/commit/1085c7813224a0a65f1dac7275cbc3244e23c386","primary_source":"","published":"2026-01-21T21:31:14.664Z"},{"affected":">= 3.21.0, < 3.21.16","affected_versions_present":true,"cve_id":"CVE-2025-58442","cve_url":"https://cve.blacktree.nl/cve/CVE-2025-58442","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2025-09-10T13:50:40.777Z","patch_url":"","primary_source":"","published":"2025-09-09T19:46:45.798Z"},{"affected":">= 3.10.0, < 3.14.64; >= 3.15.0, < 3.15.39; >= 3.16.0, < 3.16.39; >= 3.17.0, < 3.17.35; >= 3.18.0, < 3.18.31; >= 3.19.0, < 3.19.19","affected_versions_present":true,"cve_id":"CVE-2024-31205","cve_url":"https://cve.blacktree.nl/cve/CVE-2024-31205","fixed":"An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.","last_modified":"2024-08-02T01:46:04.600Z","patch_url":"https://github.com/saleor/saleor/security/advisories/GHSA-ff69-fwjf-3c9w","primary_source":"","published":"2024-04-08T14:26:30.971Z"},{"affected":">= 3.14.56, < 3.14.61; >= 3.15.31, < 3.15.37; >= 3.16.27, < 3.16.34; >= 3.17.25, < 3.17.32; >= 3.18.19, < 3.18.28; >= 3.19.5, < 3.19.15","affected_versions_present":true,"cve_id":"CVE-2024-29888","cve_url":"https://cve.blacktree.nl/cve/CVE-2024-29888","fixed":"An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.","last_modified":"2024-08-02T01:17:58.440Z","patch_url":"https://github.com/saleor/saleor/commit/22a1aa3ef0bc54156405f69146788016a7f3f761","primary_source":"","published":"2024-03-27T18:53:44.698Z"},{"affected":">= 2.11.0, < 3.7.68; >= 3.8.0, < 3.8.40; >= 3.9.0, < 3.9.49; >= 3.10.0, < 3.10.36; >= 3.11.0, < 3.11.35; >= 3.12.0, < 3.12.25; >= 3.13.0, < 3.13.16","affected_versions_present":true,"cve_id":"CVE-2023-32694","cve_url":"https://cve.blacktree.nl/cve/CVE-2023-32694","fixed":"An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.","last_modified":"2025-01-16T19:21:54.740Z","patch_url":"https://github.com/saleor/saleor/commit/1328274e1a3d04ab87d7daee90229ff47b3bc35e","primary_source":"","published":"2023-05-25T14:29:10.217Z"},{"affected":">= 2.0.0, < 3.1.48; >= 3.11.0, < 3.11.12; >= 3.10.0, < 3.10.14; >= 3.9.0, < 3.9.27; >= 3.8.0, < 3.8.30; >= 3.7.0, < 3.7.59","affected_versions_present":true,"cve_id":"CVE-2023-26052","cve_url":"https://cve.blacktree.nl/cve/CVE-2023-26052","fixed":"No fixed version is explicitly recorded in the structured CVE data.","last_modified":"2025-03-05T16:10:59.226Z","patch_url":"","primary_source":"","published":"2023-03-02T18:54:33.030Z"},{"affected":">= 2.0.0, < 3.1.48; >= 3.11.0, < 3.11.12; >= 3.10.0, < 3.10.14; >= 3.9.0, < 3.9.27; >= 3.8.0, < 3.8.30; >= 3.7.0, < 3.7.59","affected_versions_present":true,"cve_id":"CVE-2023-26051","cve_url":"https://cve.blacktree.nl/cve/CVE-2023-26051","fixed":"An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.","last_modified":"2025-03-05T20:41:26.937Z","patch_url":"https://github.com/saleor/saleor/commit/31bce881ccccf0d79a9b14ecb6ca3138d1edeec1","primary_source":"","published":"2023-03-02T18:29:48.611Z"},{"affected":">= 2.0.0, < 3.1.24; >= 3.2.0, < 3.2.14; >= 3.3.0, < 3.3.26; >= 3.4.0, < 3.4.24; >= 3.5.0, < 3.5.23; >= 3.6.0, < 3.6.18; >= 3.7.0, < 3.7.17","affected_versions_present":true,"cve_id":"CVE-2022-39275","cve_url":"https://cve.blacktree.nl/cve/CVE-2022-39275","fixed":"An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.","last_modified":"2025-04-23T16:52:27.439Z","patch_url":"https://github.com/saleor/saleor/commit/96e04c092ddcac17b14f2e31554aa02d9006d0ce","primary_source":"","published":"2022-10-06T00:00:00.000Z"},{"affected":"Issue was introduced by merge commit: e1b01bad0703afd08d297ed3f1f472248312cc9c. This commit was released as part of 2.0.0 release [fixed: 2.3.1]","affected_versions_present":true,"cve_id":"CVE-2019-1010304","cve_url":"https://cve.blacktree.nl/cve/CVE-2019-1010304","fixed":"An authoritative update reference is available, but the fixed version is not recorded in the structured CVE fields. Check the linked vendor advisory for the applicable release.","last_modified":"2024-08-05T03:07:18.378Z","patch_url":"https://github.com/mirumee/saleor/issues/3768","primary_source":"","published":"2019-07-15T14:45:39.000Z"}],"source_generated_at":"2026-10-09T06:17:25.511Z","vendor":"Saleor"}}